Unlike IPv4 addresses, which are typically masked by a NAT, IPv6 addresses
could easily be correlated with user activity, endangering their privacy.
Mitigations to address this privacy concern have been deployed, making existing
approaches for address-to-user correlation unreliable. This work demonstrates
that an adversary could still correlate IPv6 addresses with users accurately,
even with these protection mechanisms. To do this, we propose an IPv6 address
correlation model - SiamHAN. The model uses a Siamese Heterogeneous Graph
Attention Network to measure whether two IPv6 client addresses belong to the
same user even if the user's traffic is protected by TLS encryption. Using a
large real-world dataset, we show that, for the tasks of tracking target users
and discovering unique users, the state-of-the-art techniques could achieve
only 85% and 60% accuracy, respectively. However, SiamHAN exhibits 99% and 88%
accuracy.

该论文展示了一种基于 IPv6 地址相关性模型 - SiamHAN 的方法，即使在受到 TLS 加密保护的情况下，对于追踪目标用户和发现独特用户的任务，其准确性分别为 99％和 88％。

SiamHAN：利用同构异构图注意力网络对 TLS 加密流量的 IPv6 地址关联攻击

SiamHAN: IPv6 Address Correlation Attacks on TLS Encrypted Traffic via Siamese Heterogeneous Graph Attention Network

Active network measurements constitute an impor- tant part in gaining a
better understanding of the Internet. Although IPv4-wide scans are now easily
possible, random active probing is infeasible in the IPv6 Internet. Therefore,
we propose a hybrid approach to generate a hitlist of IPv6 addresses for
scanning: First, we extract IPv6 addresses from passive flow data. Second, we
leverage publicly available resources such as rDNS data to gather further IPv6
addresses. Third, we conduct traceroute measurements from several vantage
points to obtain additional addresses. We perform multiple active measurements
on gathered IPv6 addresses and evaluate response rates over time. We
extensively compare all IPv6 address sources. In total we found 150M unique
IPv6 addresses over the course of four weeks. Our hitlist covers 72% of
announced prefixes and 84% of Autonomous Systems. Finally, we give concrete
recommendations to maximize source efficiency for different scan types.

研究采用混合方法生成 IPv6 地址的命中列表，包括从被动流数据中提取 IPv6 地址，利用可公开获取的资源（如 rDNS 数据）收集更多 IPv6 地址，并从多个角度进行 traceroute 测量以获得其他地址。最终给出不同扫描类型的具体建议。

扫描 IPv6 互联网：朝着全面清单的方向

Scanning the IPv6 Internet: Towards a Comprehensive Hitlist

In this paper, we introduce Entropy/IP: a system that discovers Internet
address structure based on analyses of a subset of IPv6 addresses known to be
active, i.e., training data, gleaned by readily available passive and active
means. The system is completely automated and employs a combination of
information-theoretic and machine learning techniques to probabilistically
model IPv6 addresses. We present results showing that our system is effective
in exposing structural characteristics of portions of the IPv6 Internet address
space populated by active client, service, and router addresses.
In addition to visualizing the address structure for exploration, the system
uses its models to generate candidate target addresses for scanning. For each
of 15 evaluated datasets, we train on 1K addresses and generate 1M candidates
for scanning. We achieve some success in 14 datasets, finding up to 40% of the
generated addresses to be active. In 11 of these datasets, we find active
network identifiers (e.g., /64 prefixes or `subnets') not seen in training.
Thus, we provide the first evidence that it is practical to discover subnets
and hosts by scanning probabilistically selected areas of the IPv6 address
space not known to contain active hosts a priori.

本文介绍了 Entropy/IP：一种基于 IPv6 地址子集分析发现互联网地址结构的系统，它是完全自动化的并结合信息论和机器学习技术概率建模 IPv6 地址。通过该系统，可以成功地发现不包含活动主机的 IPv6 地址空间中潜在的子网和主机。